Saint Agnes Health Care, Inc.

St. Agnes Healthcare Inc. reported to HHS on 2021-05-07 a Hacking/IT Incident affecting 2821 individuals. Breached information located on Network Server. A business associate was the victim of a cyber-attack affecting ePHI including names, DOB, and prescription info.

Saint Agnes Medical Center experienced a Business Email Compromise (BEC) attack on May 2, 2016, where a scammer impersonated the CEO to request W-2 information via email. The incident compromised the 2015 W-2 data (including names, addresses, salaries, withholding info, and Social Security Numbers) of 2,812 employees. No patient data or systems were breached. The organization notified the California Attorney General and offered one year of Experian ProtectMyID Elite credit monitoring to affected employees.

Saint Agnes Health Care, Inc. (MD) reported to HHS OCR on 2015-04-24 a Hacking/IT Incident affecting 24,967 individuals. An unauthorized user gained access to employee email accounts via a phishing attack. Breached PHI included demographic, financial, and clinical information. The CE notified HHS, affected individuals, and media. Post-breach, the CE conducted additional phishing-awareness training and implemented additional email safeguards. OCR reviewed the CE's risk analysis and risk management plan.